Salesforce Mobile SDK 14.0.1-rc.0

What's New in Mobile SDK 14.0.1-rc.0

This release candidate, Mobile SDK 14.0.1-rc.0, is available for early testing before the Mobile SDK 14.0.1 general-availability release. Additional release candidates might be published before the general-availability release.

For an overview of all 14.0 changes, see the Mobile SDK 14.0.0 release notes.

Changes Since 14.0.0

Authentication

• DPoP support in Native Login — Native Login now supports DPoP on every path that produces a session: DPoP proofs, dpop_jkt, and nonce retry on the authorize and token requests, per-user key ownership, and persisted DPoP accounts. A request is replayed only after a genuine use_dpop_nonce challenge (HTTP 400/401 with an error=use_dpop_nonce body and a non-empty DPoP-Nonce header). The per-user DPoP feature marker follows the token type across repeated same-user DPoP/Bearer reauthentication. This change also adds a temporary htu canonicalization workaround, applied to DPoP proofs for token, refresh and REST requests (not only Native Login), for Experience Cloud sites with a URL path prefix (vforcesite) until a server-side fix is available. (#3063)
• DPoP login for Experience Cloud (community) users — DPoP login against a community login server failed with 403 Bad_OAuth_Token on the identity call even though the /token exchange succeeded. DPoPNonceCache now falls back to the most recently issued nonce for the credential when no nonce is cached yet for the exact host being called. No server change is required. (#3054)
• Identity fetch refreshes and replays on 401/403 — The identity request now goes to the id URL exactly as returned in the token response, for all users, and a 401 or 403 refreshes the credentials and replays the request until it succeeds. This matches iOS and works around the identity service intermittently rejecting valid JWT access tokens with 403 Wrong_Org right after login. Community users now also migrate tokens against their community URL, and an IDENTITY_ATTEMPTS info line is logged per login. (#3055)
• Identity endpoint 403 triggers a token refresh — OAuthRefreshInterceptor previously ignored 403 Bad_OAuth_Token outside /services/oauth2/, so the identity endpoint was never refreshed. It now refreshes and retries once (Bearer and DPoP), recognizing configured Experience Cloud identity URLs, and preserves the response body when refresh isn't allowed. (#3062)
• Profile photo download carries a DPoP proof — UserAccount.downloadProfilePhoto() used the system DownloadManager with a Bearer header and no DPoP proof. Against the Winter '27 (266) server, a proof-less request with a DPoP-bound token revokes the token, so the first REST call after login failed with 401 INVALID_AUTH_HEADER. The photo is now downloaded with OkHttp (DPoP proof with nonce retry and per-redirect re-signing for DPoP-bound tokens, Bearer otherwise); a failed download leaves the cached photo untouched, and refresh paths skip the download when a photo is already cached. (#3059)
• Login-server marker for Native Login — A successful Native Login now registers a per-user login-server (L) feature marker, as on iOS: L5 for a community URL, L4 for a My Domain URL. Previously Native Login sessions had none. (#3065)
• onAuthFlowCancelled() callback on LoginActivity — Apps that subclass LoginActivity can override a new protected onAuthFlowCancelled() to learn when the user abandons login (Back, or dismissal of the login Custom Tab). Backgrounding, rotation, locked-screen Back, the optional Login for Admin tab and successful OAuth redirects don't trigger it. (#3057)
• Login hosts preserved with unrestricted MDM — Default and app-defined servers.xml hosts and user-entered hosts stay visible when MDM provisions hosts with OnlyShowAuthorizedHosts=false. With OnlyShowAuthorizedHosts=true, only the current managed hosts are shown and hidden user-entered entries are kept in storage. (#3060)

Hybrid

• Redirect destinations validated before refresh loads — Return URLs supplied by login and session redirects (for example retURL / startURL with ec=301/302) are canonicalized and validated against Cordova's navigation policy before the authentication refresh and again before loading. Denied destinations recover to the app's configured start page. Malformed ec parameters no longer crash the helper. (#3061)

Bug Fixes

• ACCESS_NETWORK_STATE declared in the SDK manifest — HttpAccess.hasNetwork() requires the permission, which the SDK now declares itself, resolving a MissingPermission lint error. Apps that already declare it see no change; others inherit it through manifest merging. (#3066)
• Screen-lock feature persistence ANR — The screen-lock feature flag is now persisted on Dispatchers.IO before the newly authenticated account is published as current. (#3058)

Developer Support

• Native Login mode in Login Options — Any app with developer support enabled (the default in debug builds) can now log in with Native Login from the Login Options screen without app code changes. A new Authentication Mode (Browser / Native) selector exposes the Native Login client ID, callback URL, community login URL, DPoP and hybrid authentication options, saved separately from the browser configuration. A built-in Compose login form handles the flow, and an app's own nativeLoginActivity always takes precedence. Automation can configure the mode through SalesforceSDKManager.debugLoginSettings. Apps that don't enable developer support are unchanged. (#3065)
• Custom Tab browser selector in Login Options — Debug builds with developer support enabled can now pick which installed browser hosts the login Custom Tab, making it easy to test advanced authentication with non-Chrome browsers. The host app must declare package visibility (<queries>). (#3056)

Grab the Latest Here

• Android: GitHub, npm, MavenCentral
• iOS: GitHub, npm
• Hybrid: npm
• React Native: npm
• Sfdx plugin: npm